High severity · published Mar 10, 2026
CVE-2026-30933
FileBrowser Quantum Incomplete Remediation of CVE-2026-27611: Password-Protected Share Bypass via /public/api/share/info
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-beta and 1.2.2-stable, the remediation for CVE-2026-27611 is incomplete. Password protected shares still disclose tokenized downloadURL via /public/api/share/info. This vulnerability is fixed in 1.3.1-beta and 1.2.2-stable.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FI
filebrowser · gtsteffaniak
>= 1.3.0-beta, < 1.3.1-beta; >= 1.2.6-beta, < 1.2.2-stable; = 1.1.3-stable · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-30933
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-30933
Release Notes
https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.2.2-stable
Release Notes
https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.3.1-beta
Exploit
https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-525j-95gf-766f
More from filebrowser
9.3
CVE-2026-48777
FileBrowser Quantum: Path Traversal in public share PATCH allows file ops outside shared directory
9.1
CVE-2026-44542
FileBrowser Quantum: Unauthenticated Path Traversal in Public Share Delete Allows Arbitrary File Deletion
8.7
CVE-2026-46410
FileBrowser Quantum: unauthenticated user share share info
8.6
CVE-2026-116682
FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directory
7.7
CVE-2026-54910
FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files